News for hackers. Stuff that matters.

A comment on OpenAI API keys leaking through app binaries. Parent comment

Re:OpenAI API keys leaking through app binaries by joe_the_user on Thursday April 13, 2023 @01:56PM (#35559398)
Well, if you have an app that's a thin structure on top of GPT-4, adding your own pipe between your client and OpenAI could add a lot to the cost and complexity of the app. Which is to say it's not surprising that people don't do it.

The genius and the craziness of GPT-4 is you can make whole app with a prompt like "now you're a clown painting custom faces on kids based on their favorite animals" and some glue-code. Needing to add a 3 layer network infrastructure with isn't appealing I'd imagine.

[ Parent | on HN ]
Re:OpenAI API keys leaking through app binaries by mousetree on Thursday April 13, 2023 @02:05PM (#35559536)
Could be as simple and cost-efficient as a Cloudflare worker that adds your key and passes the query along
[ Parent | on HN ]
Re:OpenAI API keys leaking through app binaries by lucakiebel on Thursday April 13, 2023 @03:05PM (#35560489)
Or a 5€/mo Hetzner server running Nginx, though Cloudflares free offering is very generous
[ Parent | on HN ]
Re:OpenAI API keys leaking through app binaries by jeffy90 on Thursday April 13, 2023 @03:25PM (#35560833)
You'd need some kind of authentication as well.
[ Parent | on HN ]
Re:OpenAI API keys leaking through app binaries by pxx on Thursday April 13, 2023 @05:39PM (#35562454)
Errrr, I assume your app can pass said authentication? If so, then it's meaningless; that's again a secret not under your control.
[ Parent | on HN ]
Re:OpenAI API keys leaking through app binaries by shri_krishna on Friday April 14, 2023 @01:53AM (#35565968)
You have to use Cloudflare Workers in Unbounded mode to do this (especially if you are streaming using EventSource or WebSockets). Bundled mode won't cut it as it closes connection after 50ms of Javascript execution.
[ Parent | on HN ]
Re:OpenAI API keys leaking through app binaries by orf on Friday April 14, 2023 @01:59PM (#35572595)
That’s 50ms of CPU execution, which does not include waiting for IO.
[ Parent | on HN ]
Re:OpenAI API keys leaking through app binaries by de6u99er on Thursday April 13, 2023 @04:05PM (#35561367)
Not only that, but it makes not much difference if they call the GPT Api directly or through a proxy. Only thing that eould really help is having users register and authenticate through the proxy.
[ Parent | on HN ]
Re:OpenAI API keys leaking through app binaries by ceejayoz on Thursday April 13, 2023 @04:17PM (#35561503)
The proxy approach at least lets you rate limit by IP, limit the length of the strings (and thus the token cost), etc. The API key may also grant access to other models, administrative IPs, etc. you don't want people using.

Far, far, far better than nothing.

[ Parent | on HN ]